LoginSign Up
← Back to all sparks
N

ntopng

ANALYTICS
Velocity0.0

Network traffic monitoring and analysis tool

www.ntop.org ↗

ntopng grew from traffic monitor into asset inventory and vulnerability scanner — one major at a time

network-monitoringasset-inventoryclickhousevulnerability-scanningobservability
◆Current state
ntopng ships roughly one stable major a year. The 6.x line added vulnerability scanning and CVE support, then an Asset Inventory and Digital Twin with an assets dashboard, then autonomous-system dashboards with native ClickHouse Cloud SSL and a direct flow dump mode for real-time export. The last published release was 6.6 in November 2025, so this feed is currently quiet.
◆Where it's heading
Each major has annexed an adjacent category rather than deepening flow analysis: security posture in 6.0, asset management in 6.4, and infrastructure-scale visibility in 6.6. Underneath, ClickHouse has steadily replaced the older storage paths, moving from an option in 5.2 to the assumed backend with a real-time export mode. The result is a product competing well outside its original network-monitoring lane.
◆Prediction
With the last release nine months old, the next major is overdue; based on the pattern it would extend the asset and security surfaces rather than the flow engine.

◆Recent moves

  1. 8mo ago

    ntopng 6.6: AS dashboards and real-time ClickHouse export

    Adds autonomous-system dashboards, Sankeys and AS statistics, reworks flow collection, and introduces a direct dump mode for real-time ClickHouse export with native ClickHouse Cloud SSL support. The real-time export path is the structural change here.

    View source ↗
  2. 1y ago

    ntopng 6.4 adds Asset Inventory and Digital Twin

    ⚡ SPARK

    6.4 introduced an Asset Inventory and Digital Twin with a dedicated dashboard, an Infrastructure Dashboard spanning multiple regions, and Quality of Experience indicators — moving ntopng from observing traffic to maintaining a model of the network itself.

    View source ↗
  3. 1y ago

    ntopng 6.2: memory halved, MITRE alert classification

    A performance-focused major that halved memory footprint and reduced lock contention, while adding MITRE alert classification and a new security report. The optimisation work is what made the later feature expansion affordable.

    View source ↗
  4. 2y ago

    ntopng 6.0 adds vulnerability scanning and CVE support

    ⚡ SPARK

    6.0 added vulnerability scanning and CVE support to a traffic monitor, along with configurable dashboards, traffic reports, Modbus alerts and PagerDuty and TheHive integrations. It is where the security direction starts.

    View source ↗
  5. 3y ago

    ntopng 5.6: Kafka, ClickHouse clusters, Vue.js rework

    Adds Kafka support, ClickHouse cluster support and an XL license tier, and begins reworking pages onto Vue.js toward a responsive client. Infrastructure groundwork for the larger deployments the later releases target.

    View source ↗
  6. 3y ago

    ntopng 5.4: new search, ELK 8 support, service map additions

    Adds a rebuilt search bar, ELK 8 support with a standardised export format, centrality and similarity maps in the service map, and alert exclusion management. Analysis-surface work rather than collection work.

    View source ↗